@stopnetic/js 0.0.6-pilot → 0.1.1

package/README.md

@@ -1,40 +1,62 @@
-# @stopnetic/js — JavaScript website guard
+# @stopnetic/js - JavaScript and TypeScript website guard
+
+Unreleased country controls: server options `countryBlocking: true` and a trusted
+`countrySource` enable the compatible protocol. The `/server` environment helper
+also reads `STOPNETIC_COUNTRY_BLOCKING=true`. Deploy and test guarded requests
+before enabling the country policy in the dashboard. Remove local `publicPaths`
+bypasses and secure your ingress/origin. Published 0.1.0 lacks this feature.
+See [setup, recovery and coverage limits](../../docs/country-access.md).
 
 Stopnetic checks access **on your server before sending pages, files or API data**.
-Your frontend can be Angular, Vue, React, Svelte, plain JavaScript, or an older
-frontend build. No React/Vue/Angular dependency or version upgrade is required.
-The hosting server must run Node.js 22 or newer. This is an MIT-licensed pilot SDK;
-hosted production/provider validation is still required before paid rollout.
-
-Version **0.0.6-pilot is prepared locally; it is not published yet**. It adds
-framework-specific SSR instructions and a dashboard SSR selector for Angular,
-React Router, custom React SSR, Nuxt, custom Vue SSR, SvelteKit, Astro, SolidStart
-and custom Node servers. Examples identify the actual server entry, prerender
-settings, deployed Node runtime and context/body preservation. Next.js uses its
-dedicated adapter; other languages/Edge are explicitly outside this Node SDK.
-Unchanged 0.0.2/0.0.3/0.0.4/0.0.5 guides migrate safely; custom edits require merging.
-SSR and static rendering remain separate choices, with document navigation
-default and no global checking screen. Optional browser demos remain available.
-Angular, React, Vue, Svelte, Solid and plain JavaScript share the browser/server
-contracts; no React dependency is required. See the
-[complete generated guide](dist/client-guide.md) for SSR, static builds, frameworks,
-client navigation, API protection and runtime restrictions.
-
-The currently published **0.0.5-pilot** clarifies rendering/navigation and includes full frontend examples and the
-framework-independent server/browser setup, complete Node application wrapper
-and older-guide migration. Version 0.0.2 added the reusable browser/server setup for Netlify, Vercel
-and Node/Express, a browser access check and optional React boundary. It also
-normalizes public PEM formatting and rejects placeholder or reused installation
-keys as cookie secrets. Install the published pilot with:
+Use it with Node.js and Express, with frontend examples for Angular, React, Vue,
+Svelte, Solid and plain JavaScript. No frontend framework is a required dependency.
+Your hosting server must run **Node.js 22 or newer**; browser-only JavaScript does
+not enforce protection on its own. Keep your existing SSR or static rendering.
+
+## Optional traffic insights (unreleased)
+
+The working tree supports `trafficInsights: true` and
+`countrySource: 'none' | 'vercel' | 'cloudflare'` in server guard options. The
+`@stopnetic/js/server` helpers also read `STOPNETIC_TRAFFIC_INSIGHTS=true` and
+`STOPNETIC_COUNTRY_SOURCE=none` from the website's server environment. These
+settings are optional and collection is off by default. Published 0.1.0 does
+not send these fields; use a compatible future release or local packed SDK.
+
+Only a country code/source and broad device category are sent. No raw IPs or full
+user-agent strings leave the server for this feature, and no network location
+lookup is made. Unsupported sources/devices remain Unknown. Reported metadata
+is approximate and does not authorize requests or identify people/bots.
+
+Explicitly trust a country source only on the correct hosting ingress. For
+Cloudflare, prevent direct-origin access or strip and rewrite visitor-supplied
+headers. Deploy compatible service ingestion before updating and deploying the
+website's guard. Disabling collection stops new context; stored context follows
+the event retention/deletion policy.
+
+## Install
+
+Run inside your website project:
 
 ```sh
-npm install @stopnetic/js@pilot
+npm install @stopnetic/js
 ```
 
+For Next.js 16 App Router, use [@stopnetic/next](https://www.npmjs.com/package/@stopnetic/next).
+
+This release includes server/browser helpers, framework-specific SSR instructions,
+complete optional frontend examples, Netlify/Vercel/Node setup commands and bounded
+public-key parsing for raw, escaped or JSON-quoted public PEM values. Existing
+unmodified generated guides can migrate safely; customized files require merging.
+
+Read the [complete generated guide](https://unpkg.com/@stopnetic/js@0.1.0/dist/client-guide.md)
+for SSR, static builds, client navigation, API protection and runtime restrictions.
+Validate the actual deployed routing, caching and provider configuration before
+production use. Browser verification does not prove human identity.
+
 ## Framework implementation examples
 
 SSR apps use the **SSR framework** selector, not the optional browser-demo
-selector. [Framework SSR instructions](dist/client-guide.md#ssr-framework-instructions)
+selector. [Framework SSR instructions](https://unpkg.com/@stopnetic/js@0.1.0/dist/client-guide.md#ssr-framework-instructions)
 and `examples/ssr` contain matching server code:
 
 | SSR app | Server connection |
@@ -104,19 +126,19 @@ npm run build
 npm pack
 ```
 
-Install the resulting `stopnetic-js-0.0.6-pilot.tgz` into the website project using
+Install the resulting `stopnetic-js-0.1.0.tgz` into the website project using
 `npm install <absolute-path-to-tarball>`. The installed package has no Next.js or
 other runtime dependency. The build packages the same signed decision implementation
 as the Next.js adapter. Keep `@stopnetic/next` for its Next.js 16 guided installer.
 
-## Reusable client/server setup (requires 0.0.2-pilot)
+## Reusable client/server setup
 
-Follow the [hosting guide](../../docs/javascript-hosting-guide.md) for the full
+Follow the [hosting guide](https://github.com/KlimentSidorov/stopnetic/blob/main/docs/javascript-hosting-guide.md) for the full
 Netlify, Vercel or Node procedure, server settings, page HTTP 404 enforcement,
 frontend/API wiring and diagnosis. The dashboard's Integration and Documentation
 pages offer the same provider choices and complete copyable page-guard examples.
 
-The published 0.0.2-pilot includes these commands and subpath exports.
+These commands and subpath exports are included in this release.
 Older 0.0.1-pilot installations must upgrade before using them.
 
 Run setup at the app's package.json, choose hosting, and preview before writing:
@@ -143,7 +165,7 @@ Functions secret store. Copy the generated cookie secret without committing it.
 Wire the server page guard and EACH protected API following the generated guide.
 Browser route checks are optional for retained SPA navigation.
 Run `npm exec --no -- stopnetic-js check` after setting credentials (`--local-http`
-for a loopback pilot). This check validates configuration and generated files
+for a loopback local test). This check validates configuration and generated files
 offline; it cannot prove deployment routing, API coverage or browser integration.
 Deploy once, then dashboard changes apply on subsequent guarded requests.
 
@@ -154,7 +176,7 @@ server environment loader. Production credentials belong in runtime settings.
 
 ### Shared browser startup and Node SSR
 
-The generated [framework-independent guide](dist/client-guide.md) defaults to
+The generated [framework-independent guide](https://unpkg.com/@stopnetic/js@0.1.0/dist/client-guide.md) defaults to
 server document navigation: leave browser startup/layout intact, use normal
 links, and let the server apply dashboard policies. It also gives an OPTIONAL
 browser startup gate and separate OPTIONAL SPA router demos. Do not combine
@@ -232,10 +254,10 @@ request and preserve ordinary request bodies. Denials/outages return empty
 
 For a real HTTP 404 on a Netlify SPA page, use the optional page-serving function
 in `examples/netlify-spa-pages.mjs` and follow
-[`docs/netlify-spa-page-requests.md`](../../docs/netlify-spa-page-requests.md).
+[`docs/netlify-spa-page-requests.md`](https://github.com/KlimentSidorov/stopnetic/blob/main/docs/netlify-spa-page-requests.md).
 It checks signed access before reading the bundled entry HTML. The browser
 boundary alone cannot change the initial document's HTTP status. This example
-uses the published 0.0.2-pilot server helpers; the setup CLI does not install it
+uses the server helpers included in this release; the setup CLI does not install it
 automatically. Keep static bundles public and private data in guarded APIs.
 
 For Vercel page responses, the manual Node routing middleware in
@@ -275,7 +297,7 @@ rollout. Hosting contracts are simulated locally; live provider tests are pendin
 | Angular, Vue, React, Svelte SPA or plain HTML/JS | Node/Express server serving its built output, before static files and SPA fallback |
 | Existing Node/Express server, including Express 4 and 5 | First root middleware, before body parsers, routes and data handlers |
 | Node-hosted framework with Web `Request`/`Response` hooks | `createStopneticHandler` before the framework renders or serves data |
-| Next.js 16 App Router | Published `@stopnetic/next@pilot` and its guided installer |
+| Next.js 16 App Router | Published `@stopnetic/next` and its guided installer |
 | Older Next.js with a customer-owned Node server | Generic middleware before the Next request handler; native older Next installers are not supplied |
 | Static-only hosting / browser-only scripts | Needs a server or compatible edge/proxy in front, or a separately protected content API |
 
@@ -420,14 +442,14 @@ could expose an alternative path to protected content.
 
 An installed guard's first valid request starts the site's account trial. Key
 rotation/revocation and domain/account/subscription gates are checked by the service.
-Access reports are best effort and cannot establish delivery guarantees.
-With the updated dashboard, prepared 0.0.2 links same-page challenges, verification
-and the first reported access result. The Challenge outcomes panel distinguishes
-allowed, blocked, waiting, not completed and verified without an access result;
-older evidence may be unavailable. It does not identify humans or bots. Install
-the updated SDK on your server after deploying the dashboard update.
-
-Validate your actual hosting, cache rules, browser flow, API paths and provider configuration
+Access reports are best effort and cannot establish delivery guarantees.
+With the updated dashboard, the SDK links same-page challenges, verification
+and the first reported access result. The Challenge outcomes panel distinguishes
+allowed, blocked, waiting, not completed and verified without an access result;
+older evidence may be unavailable. It does not identify humans or bots. Install
+the updated SDK on your server after deploying the dashboard update.
+
+Validate your actual hosting, cache rules, browser flow, API paths and provider configuration
 before onboarding paying customers.
 
 ## Maintainer checks and release
@@ -435,14 +457,19 @@ before onboarding paying customers.
 From this folder: `npm ci`, `npm test`, `npm run test:package`. Tests include real
 Node HTTP traffic, Express 4/5 static/SPA/API serving, challenges, body preservation,
 signed decision failures and package consumption from ESM, CommonJS and TypeScript.
-The tarball includes only `dist`, README, MIT license and manifest. No secrets,
-examples, tests, build scripts or dashboard are published. Build from the repository
+The tarball includes runtime/types in `dist`, the setup CLI in `bin`, the public
+frontend/SSR examples, README, MIT license and manifest. No secrets, tests, build
+scripts or dashboard are published. Build from the repository
 before packing; published consumers do not need the repository or build scripts.
 
 Publishing is a separate owner step after these checks:
 
 ```sh
-npm publish --access public --tag pilot --registry=https://registry.npmjs.org/
+npm publish --access public --tag latest --registry=https://registry.npmjs.org/
 ```
 
 Publishing this package does not update the existing `@stopnetic/next` release.
+
+## Source and support
+
+[Source repository](https://github.com/KlimentSidorov/stopnetic/tree/main/integrations/javascript) | [Report an issue](https://github.com/KlimentSidorov/stopnetic/issues)

package/dist/client-guide.md

@@ -101,8 +101,11 @@ STOPNETIC_COOKIE_SECRET=your_separate_random_cookie_secret
 
 The installer creates a private cookie secret in `.env.local` when missing.
 Reuse it across deployments. Do not commit `.env.local`. Copy complete PEM
-header/body/footer with real newlines or literal `\n`; quote multiline values
-in local env files. Hosting value fields do not need surrounding quotes.
+header/body/footer with real newlines or literal `\n`. The dashboard's generated
+local configuration uses an unquoted single-line key with literal `\n`; the SDK
+restores its line breaks. Hosting fields take only the value, with no variable
+name, equals sign or surrounding quotes. Manually written actual multiline PEMs
+still need quotes in env files. Previously generated quoted env files remain valid.
 Never put private settings in frontend environment files or prefix them with
 `VITE_`, `REACT_APP_` or `NEXT_PUBLIC_`. Angular's `environment.ts` is browser
 configuration, not a private server environment.
@@ -1308,7 +1311,7 @@ server endpoints.
 ## Updating an existing generated guide
 
 After installing the new SDK, rerun `stopnetic-js init --platform <same-platform>`
-(preview with `--dry-run`). An unchanged 0.0.2/0.0.3/0.0.4/0.0.5 generated guide is upgraded
+(preview with `--dry-run`). An unchanged 0.0.2/0.0.3/0.0.4/0.0.5/0.0.6 generated guide is upgraded
 with its setup manifest. Your key, cookie secret and server files are preserved.
 Customized guides or handlers require manual merging; switching platforms also
 requires review. This command does not publish, deploy or contact Stopnetic.

package/dist/guard.d.ts

@@ -13,6 +13,13 @@ export type StopneticOptions = {
   timeoutMs?: number;
   publicPaths?: string[];
   reportEvents?: boolean;
+  /** Optional coarse request analytics. No raw visitor IP or user-agent is sent. */
+  trafficInsights?: boolean;
+  /** Opt into country controls; requires trusted countrySource and no publicPaths. */
+  countryBlocking?: boolean;
+  /** Explicitly trust country headers from your ingress; default none. Cloudflare
+   * origins must prevent direct requests/header spoofing. */
+  countrySource?: 'none' | 'vercel' | 'cloudflare';
   /** Whole-site mode: unmatched routes public; requires the updated service. */
   guardMode?: 'selected' | 'site';
 };

package/dist/guard.js

@@ -1,5 +1,6 @@
 import { createHash, createHmac, randomBytes, timingSafeEqual, verify as verifySignature } from 'node:crypto';
 import { trustedSigningKeys } from './signing-keys.js';
+import { trafficContext } from './traffic-context.js';
 export { parseAdditionalDecisionPublicKeys } from './signing-keys.js';
 
 const unavailable = retryAfter => new Response(null, { status: 503, headers: {
@@ -62,14 +63,14 @@ function bootstrap(ticket, verifyPath) {
 
 /** Pilot guard for server-side Next.js Proxy and Route Handlers. */
 export function createStopnetic({ siteId, apiUrl, apiToken, decisionPublicKey, additionalDecisionPublicKeys = [], cookieSecret, verifyPath = '/__stopnetic/verify',
-  cookieName = 'stopnetic_pilot_session', secureCookie = true, fetchImpl = fetch, timeoutMs = 2000, publicPaths = [], reportEvents = true, guardMode = 'selected' }) {
+  cookieName = 'stopnetic_pilot_session', secureCookie = true, fetchImpl = fetch, timeoutMs = 2000, publicPaths = [], reportEvents = true, guardMode = 'selected', trafficInsights = false, countrySource = 'none', countryBlocking = false }) {
   if (!/^[a-z0-9][a-z0-9_-]{0,63}$/.test(siteId || '')) throw new Error('Invalid siteId');
   const credential = typeof apiToken === 'string' ? apiToken.match(/^[a-z]{1,32}_([a-f0-9]{32})\.[A-Za-z0-9_-]{43}$/) : null;
   if (!credential) throw new Error('apiToken must be an issued installation key');
   const installationId = credential[1];
-  if (typeof cookieSecret !== 'string' || cookieSecret.trim().length < 32
-    || /^<[^]*>$/.test(cookieSecret.trim())) throw new Error('cookieSecret must be at least 32 characters');
-  if (cookieSecret === apiToken) throw new Error('cookieSecret must be independent of apiToken');
+  if (typeof cookieSecret !== 'string' || cookieSecret.trim().length < 32
+    || /^<[^]*>$/.test(cookieSecret.trim())) throw new Error('cookieSecret must be at least 32 characters');
+  if (cookieSecret === apiToken) throw new Error('cookieSecret must be independent of apiToken');
   const endpoint = new URL(apiUrl);
   if (endpoint.username || endpoint.password || endpoint.search || endpoint.hash) throw new Error('Invalid apiUrl');
   if (endpoint.protocol !== 'https:' && !(endpoint.protocol === 'http:' && ['localhost', '127.0.0.1'].includes(endpoint.hostname))) {
@@ -79,8 +80,12 @@ export function createStopnetic({ siteId, apiUrl, apiToken, decisionPublicKey, a
   if (!/^[a-zA-Z0-9_-]+$/.test(cookieName)) throw new Error('Invalid cookieName');
   if (!Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 10000) throw new Error('Invalid timeoutMs');
   if (typeof reportEvents !== 'boolean') throw new Error('Invalid reportEvents');
+  if (typeof trafficInsights !== 'boolean') throw new Error('Invalid trafficInsights');
+  if (!['none', 'vercel', 'cloudflare'].includes(countrySource)) throw new Error('Invalid countrySource');
   if (!Array.isArray(publicPaths) || publicPaths.some(path => typeof path !== 'string' || !/^\/[a-zA-Z0-9_\-/.]*(?:\*)?$/.test(path))) throw new Error('Invalid publicPaths');
   if (!['selected', 'site'].includes(guardMode)) throw new Error('Invalid guardMode');
+  if (typeof countryBlocking !== 'boolean') throw new Error('Invalid countryBlocking');
+  if (countryBlocking && (countrySource === 'none' || publicPaths.length)) throw new Error('countryBlocking requires an explicit countrySource and no publicPaths bypasses');
   const publicKeys = trustedSigningKeys(decisionPublicKey, additionalDecisionPublicKeys);
   const verifyEndpoint = new URL('./verify', endpoint);
   const eventsEndpoint = new URL('./events', endpoint);
@@ -120,6 +125,15 @@ export function createStopnetic({ siteId, apiUrl, apiToken, decisionPublicKey, a
       || !Number.isSafeInteger(payload.issued_at) || !Number.isSafeInteger(payload.expires_at)
       || payload.issued_at > now + 5000 || payload.expires_at <= now || payload.expires_at <= payload.issued_at
       || payload.expires_at - payload.issued_at > 30_000) throw new Error('Invalid decision context or expiry');
+    if (countryBlocking) {
+      const control = payload.country_control;
+      const country = payload.country_decision;
+      if (!control || control.version !== 1 || control.source !== input.country_control?.source || control.country !== input.country_control?.country
+        || !country || country.version !== 1 || !['disabled', 'pass', 'country_blocked', 'country_unknown_blocked', 'country_guard_required'].includes(country.result)
+        || (country.revision !== null && (typeof country.revision !== 'string' || !/^[a-f0-9-]{36}$/.test(country.revision)))
+        || (country.result !== 'disabled' && country.revision === null)
+        || (!['disabled', 'pass'].includes(country.result) && payload.action !== 'block')) throw new Error('Invalid country decision');
+    }
     return { ...payload, receipt: envelope.decision };
   }
 
@@ -139,27 +153,33 @@ export function createStopnetic({ siteId, apiUrl, apiToken, decisionPublicKey, a
     const value = cookieValue(request, cookieName);
     const payload = verified(value, cookieSecret);
     const binding = browserBinding(request);
-    return payload?.kind === 'session' && payload.site === siteId && payload.installation === installation
-      && binding && payload.browser_hash === hash(binding) ? payload : null;
+    return payload?.kind === 'session' && payload.site === siteId && payload.installation === installation
+      && binding && payload.browser_hash === hash(binding) ? payload : null;
+  }
+
+  function countryControl(request) {
+    return countryBlocking ? { country_control: { version: 1, source: countrySource,
+      country: trafficContext(request, true, countrySource).country } } : {};
   }
 
   async function check(request) {
     const path = new URL(request.url).pathname;
     if (path === verifyPath) return null;
     if (publicPaths.some(rule => rule.endsWith('*') ? path.startsWith(rule.slice(0, -1)) : path === rule)) return null;
-    const session = validSession(request);
-    // Only link access to the page that originally requested this challenge.
-    // Sessions still authorize other configured routes without attributing them
-    // to this page's verification outcome. Legacy sessions remain usable.
-    const challenge = session?.challenge_path === path && /^[A-Za-z0-9_-]{43}$/.test(session.challenge_id || '')
-      ? session.challenge_id : null;
+    const session = validSession(request);
+    // Only link access to the page that originally requested this challenge.
+    // Sessions still authorize other configured routes without attributing them
+    // to this page's verification outcome. Legacy sessions remain usable.
+    const challenge = session?.challenge_path === path && /^[A-Za-z0-9_-]{43}$/.test(session.challenge_id || '')
+      ? session.challenge_id : null;
     const eligible = request.method === 'GET' && (request.headers.get('accept') || '').includes('text/html');
-    const binding = challenge ? browserBinding(request)
-      : !session && eligible ? browserBinding(request) || randomBytes(32).toString('base64url') : null;
+    const binding = challenge ? browserBinding(request)
+      : !session && eligible ? browserBinding(request) || randomBytes(32).toString('base64url') : null;
     let policy;
     try {
-      policy = await remote('decision', { path, method: request.method, ...(guardMode === 'site' ? { guard_mode: 'site' } : {}), ...(binding ? { browser_binding: binding } : {}),
-        ...(challenge ? { session_challenge: challenge } : {}) });
+      const context = trafficContext(request, trafficInsights, countrySource);
+      policy = await remote('decision', { path, method: request.method, ...countryControl(request), ...(context ? { traffic_context: context } : {}), ...(guardMode === 'site' ? { guard_mode: 'site' } : {}), ...(binding ? { browser_binding: binding } : {}),
+        ...(challenge ? { session_challenge: challenge } : {}) });
     } catch (error) { return unavailable(error?.retryAfter); }
     if (!policy || !['public', 'block', 'human', 'verified', 'entitled', 'default'].includes(policy.action)) return unavailable();
     // An older service must not silently apply selected-path semantics here.
@@ -199,13 +219,17 @@ export function createStopnetic({ siteId, apiUrl, apiToken, decisionPublicKey, a
       || typeof payload.path !== 'string' || !/^\/[^\s?#]*$/.test(payload.path) || !binding
       || payload.browser_hash !== hash(binding) || !/^[A-Za-z0-9_-]{43}$/.test(payload.challenge_id || '')) return concealed();
     try {
-      const result = await remote('verify', { path: payload.path, method: 'POST', challenge_id: payload.challenge_id, browser_binding: binding });
+      const result = await remote('verify', { path: payload.path, method: 'POST', challenge_id: payload.challenge_id, browser_binding: binding, ...countryControl(request) });
+      if (result.action === 'block' && result.country_decision && !['disabled', 'pass'].includes(result.country_decision.result)) {
+        await report(result, 'BLOCK');
+        return concealed();
+      }
       if (result.action !== 'verified' || result.challenge_id !== payload.challenge_id) return unavailable();
       await report(result, 'VERIFIED');
     } catch (error) { return unavailable(error?.retryAfter); }
-    const session = signed({ v: 1, kind: 'session', site: siteId, installation,
-      browser_hash: hash(binding), challenge_id: payload.challenge_id, challenge_path: payload.path,
-      exp: Date.now() + 300_000 }, cookieSecret);
+    const session = signed({ v: 1, kind: 'session', site: siteId, installation,
+      browser_hash: hash(binding), challenge_id: payload.challenge_id, challenge_path: payload.path,
+      exp: Date.now() + 300_000 }, cookieSecret);
     return new Response(null, { status: 204, headers: {
       'cache-control': 'no-store',
       'set-cookie': cookie(cookieName, session, 300),

package/dist/index.js

@@ -96,6 +96,13 @@ function requestHeaders(req, origin) {
     if (value !== undefined) headers.set(name, value);
   }
   headers.set('host', new URL(origin).host);
+  for (const name of ['user-agent', 'x-vercel-ip-country', 'cf-ipcountry']) {
+    const value = req.headers[name];
+    // Optional analytics must not turn malformed metadata into an access failure.
+    if (typeof value === 'string' && value.length <= (name === 'user-agent' ? 1024 : 2)) {
+      try { headers.set(name, value); } catch { /* Leave unsupported metadata unknown. */ }
+    }
+  }
   return headers;
 }
 

package/dist/server.d.ts

@@ -1,17 +1,17 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import type { StopneticServerOptions } from './index.js';
-export const accessBase: '/api/stopnetic';
-export function optionsFromEnv(env?: Record<string, string | undefined>): StopneticServerOptions;
-export function createStopneticAccessHandler(options?: StopneticServerOptions): (request: Request) => Promise<Response>;
-export function withStopnetic<Context extends unknown[]>(handler: (request: Request, ...context: Context) => Response | Promise<Response>,
-  options?: StopneticServerOptions): (request: Request, ...context: Context) => Promise<Response>;
-/** Node.js application wrapper: control endpoints, pages and APIs before rendering. */
-export function createStopneticAppHandler<Context extends unknown[]>(handler: (request: Request, ...context: Context) => Response | Promise<Response>,
-  options?: StopneticServerOptions): (request: Request, ...context: Context) => Promise<Response>;
-export function createStopneticAccessMiddleware(options?: StopneticServerOptions): (
-  request: IncomingMessage & { originalUrl?: string }, response: ServerResponse, next: () => unknown,
-) => Promise<unknown>;
-export function createStopneticServer(options?: StopneticServerOptions): {
-  access: ReturnType<typeof createStopneticAccessMiddleware>;
-  guard: ReturnType<typeof import('./index.js').createStopneticMiddleware>;
-};
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { StopneticServerOptions } from './index.js';
+export const accessBase: '/api/stopnetic';
+export function optionsFromEnv(env?: Record<string, string | undefined>): StopneticServerOptions;
+export function createStopneticAccessHandler(options?: StopneticServerOptions): (request: Request) => Promise<Response>;
+export function withStopnetic<Context extends unknown[]>(handler: (request: Request, ...context: Context) => Response | Promise<Response>,
+  options?: StopneticServerOptions): (request: Request, ...context: Context) => Promise<Response>;
+/** Node.js application wrapper: control endpoints, pages and APIs before rendering. */
+export function createStopneticAppHandler<Context extends unknown[]>(handler: (request: Request, ...context: Context) => Response | Promise<Response>,
+  options?: StopneticServerOptions): (request: Request, ...context: Context) => Promise<Response>;
+export function createStopneticAccessMiddleware(options?: StopneticServerOptions): (
+  request: IncomingMessage & { originalUrl?: string }, response: ServerResponse, next: () => unknown,
+) => Promise<unknown>;
+export function createStopneticServer(options?: StopneticServerOptions): {
+  access: ReturnType<typeof createStopneticAccessMiddleware>;
+  guard: ReturnType<typeof import('./index.js').createStopneticMiddleware>;
+};